What operating system and processor architecture are you using (go env)?

What did you do?

What did you expect to see?

The repo was successfully fetched.

What did you see instead?

"cannot download, uses insecure protocol"

Proposal

vcs.go is opinionated about what schemes are considered secure. If you are using a git remote helper, tools like go get will return an error because it thinks it is insecure. Passing --insecure allows the repo to be successfully fetched, but this isn't ideal because then all fetches that are pulled in from go get will allow insecure schemes.

We should let vcs.go be aware of the GIT_ALLOW_PROTOCOL environment variable to override the list of secure schemes for git fetches.